SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account.

According to its self-reported version number, the Best Practical Solutions Request Tracker (RT) running on the remote web server is version 3.x prior to 3.8.12 or version 4.x prior to 4.0.6. It is, therefore, potentially affected by the following vulnerabilities :

  - The 'vulnerable-passwords' script fails to update the     password-hash of disabled users, which could enable an     attacker to more easily determine plaintext passwords     using brute force methods. (CVE-2011-2082)

  - Multiple cross-site scripting vulnerabilities exist that     an attacker can utilize to execute script code with the     user's credentials. (CVE-2011-2083)

  - A remote, authenticated attacker can read the hashes of     former passwords and the ticket correspondence history     by accessing a privileged account. (CVE-2011-2084)

  - Multiple cross-site request forgery vulnerabilities     exist which a remote attacker can exploit to hijack user     authentication. (CVE-2011-2085)

  - A remote code execution vulnerability exists if the     optional VERP configuration options (VERPPrefix and     VERPDomain) are enabled. (CVE-2011-4458)

  - Groups are not properly disabled, allowing users in     disabled groups to gain escalated privileges.
    (CVE-2011-4459)

  - A remote, authenticated attacker can inject SQL commands     by utilizing access to a privileged account, allowing     the disclosure or manipulation of arbitrary data on the     back-end database. (CVE-2011-4460)

  - An unspecified vulnerability exists that allows remote     attackers to gain privileges or execute a restricted     amount of arbitrary code. (CVE-2011-5092)

  - The DisallowExecuteCode option is not properly     implemented and allows a remote, authenticated attacker     to bypass intended access restrictions and execute     arbitrary code by using access to a privileged account.
    (CVE-2011-5093)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Request Tracker, an issue tracking system :

  - CVE-2011-2082     The vulnerable-passwords scripts introduced for     CVE-2011-0009 failed to correct the password hashes of     disabled users.

  - CVE-2011-2083     Several cross-site scripting issues have been     discovered.

  - CVE-2011-2084     Password hashes could be disclosed by privileged users.

  - CVE-2011-2085     Several cross-site request forgery vulnerabilities have     been found. If this update breaks your setup, you can     restore the old behaviour by setting $RestrictReferrer     to 0.

  - CVE-2011-4458     The code to support variable envelope return paths     allowed the execution of arbitrary code.

  - CVE-2011-4459     Disabled groups were not fully accounted as disabled.

  - CVE-2011-4460     SQL injection vulnerability, only exploitable by     privileged users.

Please note that if you run request-tracker3.8 under the Apache web server, you must stop and start Apache manually. The 'restart' mechanism is not recommended, especially when using mod_perl.

BestPractical report :

Internal audits of the RT codebase have uncovered a number of security vulnerabilities in RT. We are releasing versions 3.8.12 and 4.0.6 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.

The vulnerabilities addressed by 3.8.12, 4.0.6, and the below patches include the following :

The previously released tool to upgrade weak password hashes as part of CVE-2011-0009 was an incomplete fix and failed to upgrade passwords of disabled users.

RT versions 3.0 and above contain a number of cross-site scripting (XSS) vulnerabilities which allow an attacker to run JavaScript with the user's credentials. CVE-2011-2083 is assigned to this vulnerability.

RT versions 3.0 and above are vulnerable to multiple information disclosure vulnerabilities. This includes the ability for privileged users to expose users' previous password hashes -- this vulnerability is particularly dangerous given RT's weak hashing previous to the fix in CVE-2011-0009. A separate vulnerability allows privileged users to obtain correspondence history for any ticket in RT. CVE-2011-2084 is assigned to this vulnerability.

All publicly released versions of RT are vulnerable to cross-site request forgery (CSRF). CVE-2011-2085 is assigned to this vulnerability.

We have also added a separate configuration option ($RestrictLoginReferrer) to prevent login CSRF, a different class of CSRF attack.

RT versions 3.6.1 and above are vulnerable to a remote execution of code vulnerability if the optional VERP configuration options ($VERPPrefix and $VERPDomain) are enabled. RT 3.8.0 and higher are vulnerable to a limited remote execution of code which can be leveraged for privilege escalation. RT 4.0.0 and above contain a vulnerability in the global $DisallowExecuteCode option, allowing sufficiently privileged users to still execute code even if RT was configured to not allow it. CVE-2011-4458 is assigned to this set of vulnerabilities.

RT versions 3.0 and above may, under some circumstances, still respect rights that a user only has by way of a currently-disabled group.
CVE-2011-4459 is assigned to this vulnerability.

RT versions 2.0 and above are vulnerable to a SQL injection attack, which allow privileged users to obtain arbitrary information from the database. CVE-2011-4460 is assigned to this vulnerability.

ID	Name	Product	Family	Severity
61434	Request Tracker 3.x < 3.8.12 / 4.x < 4.0.6 Multiple Vulnerabilities	Nessus	CGI abuses	high
59758	Debian DSA-2480-4 : request-tracker3.8 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
59283	FreeBSD : RT -- Multiple Vulnerabilities (e0a969e4-a512-11e1-90b4-e0cb4e266481)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4460

high

Tenable Plugins

high

medium

medium